Nextcloud

2026-06-11 19:11:46 -04:00 · 2026-06-11 19:11:46 -04:00 · ea64bd8c89
commit ea64bd8c89
parent 1fb9fbc5b0
7 changed files with 228 additions and 110 deletions
--- a/services/nextcloud/nextcloud-deployment.yaml
+++ b/services/nextcloud/nextcloud-deployment.yaml
@ -0,0 +1,84 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nextcloud-app
+  namespace: nextcloud
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: nextcloud-app
+  template:
+    metadata:
+      labels:
+        app: nextcloud-app
+    spec:
+      containers:
+        - name: nextcloud
+          image: nextcloud:apache
+          envFrom:
+            - secretRef:
+                name: nextcloud-secrets
+          env:
+            - name: POSTGRES_HOST
+              value: nextcloud-db
+            - name: OVERWRITEPROTOCOL
+              value: "https"
+            - name: TRUSTED_PROXIES
+              value: "10.42.0.0/16 10.43.0.0/16"
+            - name: NEXTCLOUD_TRUSTED_DOMAINS
+              value: "cloud.mynest.love"
+          volumeMounts:
+            - name: nextcloud-core-data
+              mountPath: /var/www/html
+            - name: nextcloud-user-data
+              mountPath: /var/www/html/data
+      volumes:
+        - name: nextcloud-core-data
+          persistentVolumeClaim:
+            claimName: nextcloud-app-pvc
+        - name: nextcloud-user-data
+          persistentVolumeClaim:
+            claimName: nextcloud-media-nfs-pvc
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: nextcloud-app-pvc
+  namespace: nextcloud
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: longhorn
+  resources:
+    requests:
+      storage: 100Gi
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: nextcloud-media-nfs-pv
+spec:
+  capacity:
+    storage: 1Ti
+  volumeMode: Filesystem
+  accessModes:
+    - ReadWriteMany
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: robin-nfs
+  nfs:
+    server: robin.home.nest
+    path: /nextcloud
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: nextcloud-media-nfs-pvc
+  namespace: nextcloud
+spec:
+  accessModes:
+    - ReadWriteMany
+  storageClassName: robin-nfs
+  resources:
+    requests:
+      storage: 1Ti
--- a/services/nextcloud/nextcloud-external-secrets.yaml
+++ b/services/nextcloud/nextcloud-external-secrets.yaml
@ -0,0 +1,34 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: nextcloud-secrets
+  namespace: nextcloud
+spec:
+  refreshInterval: "1h"
+  secretStoreRef:
+    name: vault-external-secrets-store
+    kind: ClusterSecretStore
+  target:
+    name: nextcloud-secrets
+    creationPolicy: Owner
+  data:
+  - secretKey: POSTGRES_DB
+    remoteRef:
+      key: nextcloud/postgres
+      property: db-name
+  - secretKey: POSTGRES_USER
+    remoteRef:
+      key: nextcloud/postgres
+      property: db-user
+  - secretKey: POSTGRES_PASSWORD
+    remoteRef:
+      key: nextcloud/postgres
+      property: db-password
+  - secretKey: NEXTCLOUD_ADMIN_USER
+    remoteRef:
+      key: nextcloud
+      property: user
+  - secretKey: NEXTCLOUD_ADMIN_PASSWORD
+    remoteRef:
+      key: nextcloud
+      property: password
--- a/services/nextcloud/nextcloud-postgres.yaml
+++ b/services/nextcloud/nextcloud-postgres.yaml
@ -0,0 +1,42 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nextcloud-db
+  namespace: nextcloud
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: nextcloud-db
+  template:
+    metadata:
+      labels:
+        app: nextcloud-db
+    spec:
+      containers:
+        - name: postgres
+          image: postgres:15-alpine
+          envFrom:
+            - secretRef:
+                name: nextcloud-secrets
+          volumeMounts:
+            - name: db-data
+              mountPath: /var/lib/postgresql/data
+              subPath: postgres-data
+      volumes:
+        - name: db-data
+          persistentVolumeClaim:
+            claimName: nextcloud-db-pvc
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: nextcloud-db-pvc
+  namespace: nextcloud
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: longhorn
+  resources:
+    requests:
+      storage: 20Gi
--- a/services/nextcloud/nextcloud-service.yaml
+++ b/services/nextcloud/nextcloud-service.yaml
@ -0,0 +1,68 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: nextcloud-app
+  namespace: nextcloud
+spec:
+  selector:
+    app: nextcloud-app
+  ports:
+    - port: 80
+      targetPort: 80
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: nextcloud-db
+  namespace: nextcloud
+spec:
+  selector:
+    app: nextcloud-db
+  ports:
+    - port: 5432
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: nextcloud-redirect
+  namespace: nextcloud
+spec:
+  redirectRegex:
+    regex: "^https://(.*)/.well-known/(card|cal)dav"
+    replacement: "https://${1}/remote.php/dav/"
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: nextcloud-hsts
+  namespace: nextcloud
+spec:
+  headers:
+    stsSeconds: 15552000
+    stsIncludeSubdomains: true
+    stsPreload: true
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: nextcloud-ingress
+  namespace: nextcloud
+  annotations:
+    cert-manager.io/cluster-issuer: "letsencrypt-prod"
+    traefik.ingress.kubernetes.io/router.middlewares: nextcloud-nextcloud-redirect@kubernetescrd, nextcloud-nextcloud-hsts@kubernetescrd
+spec:
+  tls:
+  - hosts:
+    - cloud.mynest.love
+    secretName: nextcloud-tls
+  rules:
+    - host: cloud.mynest.love
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: nextcloud-app
+                port:
+                  number: 80
--- a/services/syncthing/syncthing-deployment.yaml
+++ b/services/syncthing/syncthing-deployment.yaml
@ -1,62 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  annotations:
-    kompose.cmd: kompose convert -f compose-syncthing.yaml
-    kompose.version: 1.38.0 (HEAD)
-  labels:
-    io.kompose.service: syncthing
-  name: syncthing
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      io.kompose.service: syncthing
-  strategy:
-    type: Recreate
-  template:
-    metadata:
-      annotations:
-        kompose.cmd: kompose convert -f compose-syncthing.yaml
-        kompose.version: 1.38.0 (HEAD)
-      labels:
-        io.kompose.service: syncthing
-    spec:
-      containers:
-        - env:
-            - name: PGID
-              value: "1000"
-            - name: PUID
-              value: "1000"
-            - name: TZ
-              value: Etc/UTC
-          image: lscr.io/linuxserver/syncthing:latest
-          name: syncthing
-          ports:
-            - containerPort: 8384
-              protocol: TCP
-              name: web-ui
-            - containerPort: 22000
-              protocol: TCP
-              name: listen-tcp
-            - containerPort: 22000
-              protocol: UDP
-              name: listen-udp
-            - containerPort: 21027
-              protocol: UDP
-              name: discovery
-          volumeMounts:
-            - mountPath: /config
-              name: syncthing-config
-            - mountPath: /data1
-              name: syncthing-data
-      restartPolicy: Always
-      volumes:
-        - name: syncthing-config
-          nfs:
-            server: birdfeeder2.home.nest
-            path: /k3s/syncthing
-        - name: syncthing-data
-          nfs:
-            server: robin.home.nest
-            path: /mnt/raid/syncthing
--- a/services/syncthing/syncthing-ingress.yaml
+++ b/services/syncthing/syncthing-ingress.yaml
@ -1,19 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: syncthing-ingress
-  namespace: default
-  annotations:
-    traefik.ingress.kubernetes.io/router.entrypoints: web
-spec:
-  rules:
-  - host: sync.k3s.home.nest
-    http:
-      paths:
-      - path: /
-        pathType: Prefix
-        backend:
-          service:
-            name: syncthing
-            port:
-              name: http-web
--- a/services/syncthing/syncthing-service.yaml
+++ b/services/syncthing/syncthing-service.yaml
@ -1,29 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  annotations:
-    kompose.cmd: kompose convert -f compose-syncthing.yaml
-    kompose.version: 1.38.0 (HEAD)
-  labels:
-    io.kompose.service: syncthing
-  name: syncthing
-spec:
-  type: ClusterIP
-  ports:
-    - name: http-web
-      port: 80
-      targetPort: web-ui
-    - name: tcp-listen
-      port: 81
-      protocol: TCP
-      targetPort: listen-tcp
-    - name: udp-listen
-      port: 81
-      protocol: UDP
-      targetPort: listen-udp
-    - name: discovery
-      port: 83
-      protocol: UDP
-      targetPort: discovery
-  selector:
-    io.kompose.service: syncthing